This Policy sets out the procedure for processing and protecting personal data on the website mos-radius.ru and in its associated information systems.
Controller: Individual Entrepreneur Evgeny Andreevich Kolmakov, Taxpayer Identification Number (INN) 702401389066, Primary State Registration Number of an Individual Entrepreneur (OGRNIP) 318703100089801.
Data controller’s address: Apt. 3, 33 Kalinina Street, Seversk, Tomsk Region.
Contact for personal data enquiries: mos.radius@gmail.com, +7 925 291-30-69. Please use “Personal Data” as the subject line.
Person responsible for organising the processing of personal data: Evgeny Andreyevich Kolmakov, telephone +7 925 291-30-69.
1. Core principles
The Controller processes only the data required for predetermined lawful purposes, does not combine incompatible purposes, takes measures to ensure data accuracy and security, and ceases processing or destroys the data once the purpose has been achieved, unless the law requires its continued retention.
2. Categories of data subjects, data and purposes
Website visitors
The following data may be processed: the address of the page visited, technical information about the browser and device, IP address, the date and time of the request, essential cookies and, subject to the user’s separate choice, analytics cookies and anonymised interface interaction events. Purposes: operating and protecting the website, preventing misuse, diagnosing errors, analytics and improving the website.
Customers, payers and certificate recipients
The following data may be processed: name, telephone number, email address, details of the order, date, time, location, group composition, preferences, delivery, selected payment method and payment status, as well as the required details for organisations and individual entrepreneurs. Purposes: handling enquiries, calculating and fulfilling orders, communicating with customers, processing payments, issuing certificates, arranging tours, maintaining accounting and tax records, and handling claims.
The Controller does not receive bank card details through the website’s forms: these are processed by the payment provider on its own secure page.
Authors of comments and reviews
The name or pseudonym, email address and text of the comment or review are processed. Purposes: verification, moderation, feedback and publication of the review. The email address is not published. The name or pseudonym and the text of the review are published only after separate consent to the dissemination of personal data has been given.
Guides, employees, contractors and representatives of counterparties
The website’s associated closed internal systems may process names, business contact details, account identifiers and information about roles, assignments, services, payments and work-related activities. Purposes: organising order fulfilment, coordination, access control, record-keeping and security.
3. Legal grounds
The legal grounds for processing are the data subject’s consent, entering into and performing a contract at the data subject’s initiative, compliance with the Controller’s statutory obligations, and the Controller’s legitimate interest in ensuring website security while respecting data subjects’ rights. Consent in a website form is given using a separate checkbox that is not selected in advance. Consent to analytics cookies is requested separately in the cookie panel. Consent to disseminate a review author’s data is obtained separately from consent to ordinary processing.
4. Actions involving data and processing methods
The Controller may collect, record, organise, accumulate, store, update, retrieve and use data; transfer it to persons involved in fulfilling the relevant purpose; and restrict, erase or destroy it. Processing is performed by automated, non-automated or combined means, with transmission over secure communication channels.
5. Recipients and services
To the extent required for a specific purpose, data may be received by:
- the provider of the website’s Russian hosting and technical infrastructure;
- payment providers and banks, including T-Bank, when online payment is selected;
- email and workplace communication service providers; the administrative mailbox and contact address are hosted on Gmail, a consumer service provided by Google LLC, and therefore emails sent to this mailbox, including administrative order notifications, may be processed by Google;
- Telegram (Telegram Messenger Inc. and the parties associated with the service as specified in Telegram’s policy) — for the private internal bot, notifications and use by authorised users; the information transmitted depends on the operational scenario and is described in the Telegram Bot Data Processing Policy;
- Yandex Metrica and Google Ads — only after consent to analytics cookies;
- transport, equipment and ticket suppliers, guides and other service providers — only to the extent required to fulfil the order;
- public authorities — in cases provided for by law.
The Controller does not sell personal data or transfer it to third parties for their own advertising purposes.
6. Data localisation and cross-border transfers
When the personal data of citizens of the Russian Federation are collected online, their initial recording, organisation, accumulation, storage, updating and retrieval are carried out using a database located within the Russian Federation. Certain foreign services, including Telegram, Gmail and Google Ads following consent to analytics cookies, may technically process information transmitted to them outside the Russian Federation. Such transfer is permitted only where there is a legal basis as required by law and after the operator has completed the mandatory procedure for notifying Roskomnadzor of the cross-border transfer. Order synchronisation with Google Calendar is not used in the current process.
7. Cookies and analytics
Essential cookies enable the website to function and retain security settings and the user’s choices. They cannot be disabled through the analytics panel. Analytics and advertising trackers are not activated until “Allow” is selected. Selecting “Essential only” does not enable these trackers. The choice can be changed using the “Cookie settings” button at the bottom of the website. Once analytics consent is withdrawn, the website deletes the analytics cookies accessible to it and stops sending new analytics events.
8. Retention periods
- order and payment data — for the duration of the contract’s performance and subsequently for the periods required for accounting, tax records and the protection of the parties’ rights;
- data from an enquiry that did not result in an order — until the response has been completed and the matter resolved, after which it is deleted unless another lawful basis applies;
- a comment or review — for as long as it is published or required for moderation, until it is deleted or the relevant consent is withdrawn;
- evidence of consent — for the duration of the consent and for the period required to demonstrate the lawfulness of processing;
- internal anonymised interface telemetry — for no more than 7 days;
- technical security logs — only for the duration of diagnostics and protection, generally no more than 30 days, unless an incident or the law requires longer retention.
Once the purpose has been achieved, the data is deleted or anonymised unless a mandatory retention period is prescribed by law.
9. Data protection
Measures include access-rights controls, administrator authentication, a secure HTTPS connection, software updates, backups, logging of significant administrative actions, restrictions on direct access to internal files, storage of logs outside the public directory, and monitoring of their deletion schedules. Access is granted only to those who require it for their work.
10. Rights of the data subject
The data subject has the right to obtain information about the processing of their data; request the correction, restriction or deletion of inaccurate or unlawfully processed data; withdraw consent; request that the dissemination of data cease; and lodge a complaint about the Controller’s actions with Roskomnadzor or a court.
Requests should be sent to mos.radius@gmail.com and must make it possible to identify the applicant and the data relating to them. The Operator may request information necessary to verify the applicant’s identity. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal was received, nor does it terminate processing for which another legal basis exists.
11. Consent Documents
Consent to the processing of personal data
Consent to the Processing of Personal Data Authorised for Dissemination
Telegram Bot Data Processing Policy
12. Amendments to the Policy
The current version is published on this page. Material amendments take effect upon publication unless the amended version itself specifies a later effective date.
Revised on 4 September 2026.